How to Turn On Two-Step Verification for Google, Apple, Microsoft, Facebook, Instagram and Amazon

Start with the accounts that matter most. The FTC's order: your most sensitive accounts first (it lists bank, credit cards, email, social media, tax filing site and payment apps), then other accounts, such as shopping sites.

1. Pick your second step

Some sites let you choose, and others give you only one option. Here's what each one means:

• Authenticator app: an app on your phone (the FTC names Google Authenticator, Microsoft Authenticator and Duo as examples) makes a new code every so often. The FTC says it's safer than a text because a thief who takes over your phone number (a SIM swap) can't get the code. Google says its app still makes codes with no internet or mobile service.
• Text or call code: the site sends a one-time code to your phone, usually six digits. The FTC calls it common and simple, since all you need is a phone that gets texts. It says it beats having no second step, but an app or a security key is safer when the site offers one.
• Passkey: you sign in with your fingerprint, face or the screen lock on your phone or computer instead of typing a password. Google says a passkey skips the second step, because unlocking your device already proves it's you. Only make a passkey on a device that's yours alone: Google warns that anyone who can unlock that device can get into your account.
• Security key: a small physical key that plugs in or taps your phone. The FTC calls it the strongest choice. See Pro Mode.

Our read: if you're not sure, use an authenticator app or a passkey, and keep a text code or backup codes as your spare way in. Microsoft is phasing out text codes, so for a Microsoft account your spare is a verified email and a recovery code (steps 4 and 7).

2. Google: turn on 2-Step Verification

On a computer, go to your Google Account (myaccount.google.com) and click Security & sign-in. Under "How you sign in to Google," select Turn on 2-Step Verification and follow the on-screen steps. (If it's already on, the same spot just says 2-Step Verification.) Google's Android steps are the same: open your Google Account, tap Security & sign-in, then select Turn on 2-Step Verification.

• Google suggests its sign-in prompts (a tap on your signed-in phone) as the second step. It says they're easier than typing a code and help protect you from SIM swaps.
• A phone number you add for 2-Step Verification may not be trusted by Google for up to 7 days, Google says. A new Google Authenticator setup can also take up to 7 days to show up as a sign-in option.
• Google lets you tick "Don't ask again" so a computer or phone stops asking for the second step. Our read: only tick it on a device that's yours, never on a shared or public computer.

3. Apple: check that two-factor authentication is on

Apple says most accounts already use two-factor authentication. To check, or to turn it on (these paths are from Apple's page dated Aug 13, 2026, for current software; older versions may label them differently):

• iPhone or iPad: open Settings > [your name] > Sign-In & Security.
• Mac: open System Settings > [your name] > Sign-In & Security.
• On the web: sign in at account.apple.com and choose Upgrade Account Security if you see it.

Once it's on, Apple shows a six-digit code on your other Apple devices, or texts or calls your trusted phone number. Apple needs at least one trusted number. If you have more than one phone number, Apple suggests adding one that isn't linked to your iPhone as an extra trusted number. To add one, go to the same Sign-In & Security menu and choose Two-Factor Authentication > Add Trusted Phone Number.

If your Apple Account was set up with two-factor authentication from the start, Apple says you can't turn it off. If you turned it on recently, Apple gives you two weeks to switch back.

4. Microsoft: turn on two-step verification

Sign in at account.microsoft.com/security and select Manage how I sign in. Under Additional security, find Two-step verification and choose Turn on. Follow the on-screen steps; if you set up the Microsoft Authenticator app, you'll scan a QR code with your phone.

Two things to know first:

• Microsoft is phasing out text codes for personal accounts. It points people to passkeys and a verified email address instead.
• Add extra security info before you turn it on. With two-step verification on, your password alone can't get you back in. Microsoft says that if you lose your contact method, getting back in can take 30 days, or you could lose the account. It strongly suggests keeping three pieces of security info on your account, and it recommends two email addresses: the one you use every day and a backup.

5. Facebook and Instagram: turn on two-factor authentication

Meta is moving some people from Accounts Center to "Meta Account settings," so you may see either name.

• Facebook (computer): click your profile picture in the top right, then click Settings and privacy > Settings > Accounts Center > Password and security > Two-factor authentication. Pick your account and choose a method: a security key, an authentication app or text message (SMS) codes.
• Instagram (computer): click More in the bottom left, then Settings > See more in Accounts Center > Password and security > Two-factor authentication, and pick your account. Instagram offers an authentication app (the one it recommends), text message or WhatsApp. WhatsApp only works after you turn on text messages. Instagram says the app method can only be set up in the Instagram app for iPhone or Android.

When it asks to save or trust the browser or device, only say yes on a device that's yours. Don't do it on a public or shared computer.

6. Amazon: turn on Two-Step Verification

Go to Your Account > Login & security. Select Edit next to Two-Step Verification (2SV) Settings, then Get Started, and follow the steps. Amazon lets you get the code by text message or from an authenticator app. For more, search for "What is Two-Step Verification?" on Amazon's help site.

7. Save your backup codes and add a second way back in

This is the step that keeps you from getting locked out if you lose your phone.

• Google backup codes: go to Security & sign-in and, under "How you sign in to Google," click 2-Step Verification. Under "Backup codes," click Continue, then Get backup codes. You get a set of 10 eight-digit codes, and each one works once. Print them or download them. Making a new set cancels the old one.
• Facebook: you can get 10 recovery codes to use when you can't get to your phone.
• Instagram: if you lose access to your phone or email, a backup code gets you in.
• Google recovery phone and email: under "How you sign in to Google," add a Recovery phone and a Recovery email. Don't use a Google Voice number as your recovery phone: Google warns its codes could go to the account you're locked out of. Google says a new or changed recovery phone number can take up to 7 days to take effect.
• Apple: add a second trusted number (step 3). You can also add up to five recovery contacts, people who can help you get back in; see Pro Mode.
• Microsoft: keep those three pieces of security info up to date (step 4), and make a recovery code. On the Manage how I sign in page (account.live.com/proofs/manage/additional), scroll down to Recovery code and select Generate a new code. Microsoft says to print it and keep it somewhere safe, not on a device you use to sign in. Making a new code stops the old one from working, and Microsoft can't show you an old code again.
• Amazon: Amazon's recovery steps start with a backup method you've registered or a device it already trusts. Our read: add a backup method while you can still sign in.

Our read: keep printed codes at home with your important papers, not in a photo on the same phone. If you do get locked out of Google, Apple, Microsoft, Facebook or Instagram, our account recovery guide walks you through getting back in.